Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2017.0533 Multiple vulnerabilities have been identified in Xen 28 February 2017 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: xen Publisher: SUSE Operating System: SUSE Impact/Access: Denial of Service -- Existing Account Increased Privileges -- Existing Account Access Confidential Data -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2017-5973 CVE-2017-5898 CVE-2017-5856 CVE-2017-5579 CVE-2017-2620 CVE-2017-2615 CVE-2016-10155 CVE-2016-9922 CVE-2016-9921 CVE-2016-9911 CVE-2016-9907 CVE-2016-9776 CVE-2016-9101 Reference: ESB-2016.2826 ESB-2016.2808 ESB-2016.2707 Comment: This bulletin contains two (2) SUSE security advisories. - --------------------------BEGIN INCLUDED TEXT-------------------- SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0570-1 Rating: important References: #1000195 #1002496 #1013657 #1013668 #1014490 #1014507 #1015169 #1016340 #1022627 #1022871 #1023004 #1024183 #1024186 #1024307 #1024834 #1025188 Cross-References: CVE-2016-10155 CVE-2016-9101 CVE-2016-9776 CVE-2016-9907 CVE-2016-9911 CVE-2016-9921 CVE-2016-9922 CVE-2017-2615 CVE-2017-2620 CVE-2017-5579 CVE-2017-5856 CVE-2017-5898 CVE-2017-5973 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has three fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - CVE-2017-5973: A infinite loop while doing control transfer in xhci_kick_epctx allowed privileged user inside the guest to crash the host process resulting in DoS (bsc#1025188). - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1024183). - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024834) - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1024186). - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow flaw allowing a privileged user to crash the Qemu process on the host resulting in DoS (bsc#1024307). - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - A malicious guest could have, by frequently rebooting over extended periods of time, run the host system out of memory, resulting in a Denial of Service (DoS) (bsc#1022871) - CVE-2017-5579: The 16550A UART serial device emulation support was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1022627). - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014490) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014507) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9101: A memory leak in hw/net/eepro100.c allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device (bsc#1013668). - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013657) These non-security issues were fixed: - bsc#1000195: Prevent panic on CPU0 while booting on SLES 11 SP3 - bsc#1002496: Added support for reloading clvm in block-dmmd block-dmmd Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-297=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-297=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-297=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (x86_64): xen-debugsource-4.5.5_06-22.11.2 xen-devel-4.5.5_06-22.11.2 - SUSE Linux Enterprise Server 12-SP1 (x86_64): xen-4.5.5_06-22.11.2 xen-debugsource-4.5.5_06-22.11.2 xen-doc-html-4.5.5_06-22.11.2 xen-kmp-default-4.5.5_06_k3.12.69_60.64.32-22.11.2 xen-kmp-default-debuginfo-4.5.5_06_k3.12.69_60.64.32-22.11.2 xen-libs-32bit-4.5.5_06-22.11.2 xen-libs-4.5.5_06-22.11.2 xen-libs-debuginfo-32bit-4.5.5_06-22.11.2 xen-libs-debuginfo-4.5.5_06-22.11.2 xen-tools-4.5.5_06-22.11.2 xen-tools-debuginfo-4.5.5_06-22.11.2 xen-tools-domU-4.5.5_06-22.11.2 xen-tools-domU-debuginfo-4.5.5_06-22.11.2 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): xen-4.5.5_06-22.11.2 xen-debugsource-4.5.5_06-22.11.2 xen-kmp-default-4.5.5_06_k3.12.69_60.64.32-22.11.2 xen-kmp-default-debuginfo-4.5.5_06_k3.12.69_60.64.32-22.11.2 xen-libs-32bit-4.5.5_06-22.11.2 xen-libs-4.5.5_06-22.11.2 xen-libs-debuginfo-32bit-4.5.5_06-22.11.2 xen-libs-debuginfo-4.5.5_06-22.11.2 References: https://www.suse.com/security/cve/CVE-2016-10155.html https://www.suse.com/security/cve/CVE-2016-9101.html https://www.suse.com/security/cve/CVE-2016-9776.html https://www.suse.com/security/cve/CVE-2016-9907.html https://www.suse.com/security/cve/CVE-2016-9911.html https://www.suse.com/security/cve/CVE-2016-9921.html https://www.suse.com/security/cve/CVE-2016-9922.html https://www.suse.com/security/cve/CVE-2017-2615.html https://www.suse.com/security/cve/CVE-2017-2620.html https://www.suse.com/security/cve/CVE-2017-5579.html https://www.suse.com/security/cve/CVE-2017-5856.html https://www.suse.com/security/cve/CVE-2017-5898.html https://www.suse.com/security/cve/CVE-2017-5973.html https://bugzilla.suse.com/1000195 https://bugzilla.suse.com/1002496 https://bugzilla.suse.com/1013657 https://bugzilla.suse.com/1013668 https://bugzilla.suse.com/1014490 https://bugzilla.suse.com/1014507 https://bugzilla.suse.com/1015169 https://bugzilla.suse.com/1016340 https://bugzilla.suse.com/1022627 https://bugzilla.suse.com/1022871 https://bugzilla.suse.com/1023004 https://bugzilla.suse.com/1024183 https://bugzilla.suse.com/1024186 https://bugzilla.suse.com/1024307 https://bugzilla.suse.com/1024834 https://bugzilla.suse.com/1025188 - ------------------------------------------------------------------------------ SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0571-1 Rating: important References: #1000195 #1002496 #1005028 #1012651 #1014298 #1014300 #1015169 #1016340 #1022871 #1023004 #1024834 Cross-References: CVE-2016-9921 CVE-2016-9922 CVE-2017-2615 CVE-2017-2620 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that solves four vulnerabilities and has 7 fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024834). - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004). - A malicious guest could have, by frequently rebooting over extended periods of time, run the host system out of memory, resulting in a Denial of Service (DoS) (bsc#1022871) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169 These non-security issues were fixed: - bsc#1000195: Prevent panic on CPU0 while booting on SLES 11 SP3 - bsc#1002496: Added support for reloading clvm in block-dmmd block-dmmd - bsc#1005028: Fixed building Xen RPMs from Sources Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-296=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-296=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-296=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 x86_64): xen-debugsource-4.7.1_06-31.1 xen-devel-4.7.1_06-31.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): xen-4.7.1_06-31.1 xen-debugsource-4.7.1_06-31.1 xen-doc-html-4.7.1_06-31.1 xen-libs-32bit-4.7.1_06-31.1 xen-libs-4.7.1_06-31.1 xen-libs-debuginfo-32bit-4.7.1_06-31.1 xen-libs-debuginfo-4.7.1_06-31.1 xen-tools-4.7.1_06-31.1 xen-tools-debuginfo-4.7.1_06-31.1 xen-tools-domU-4.7.1_06-31.1 xen-tools-domU-debuginfo-4.7.1_06-31.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): xen-4.7.1_06-31.1 xen-debugsource-4.7.1_06-31.1 xen-libs-32bit-4.7.1_06-31.1 xen-libs-4.7.1_06-31.1 xen-libs-debuginfo-32bit-4.7.1_06-31.1 xen-libs-debuginfo-4.7.1_06-31.1 References: https://www.suse.com/security/cve/CVE-2016-9921.html https://www.suse.com/security/cve/CVE-2016-9922.html https://www.suse.com/security/cve/CVE-2017-2615.html https://www.suse.com/security/cve/CVE-2017-2620.html https://bugzilla.suse.com/1000195 https://bugzilla.suse.com/1002496 https://bugzilla.suse.com/1005028 https://bugzilla.suse.com/1012651 https://bugzilla.suse.com/1014298 https://bugzilla.suse.com/1014300 https://bugzilla.suse.com/1015169 https://bugzilla.suse.com/1016340 https://bugzilla.suse.com/1022871 https://bugzilla.suse.com/1023004 https://bugzilla.suse.com/1024834 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWLSilox+lLeg9Ub1AQiQaQ//TTEuDcBVQVcZ4i8ICfMO8f0RhpUnPYSt ky5lpMULsQed6mU6UOQtJKSIw37dRdc6YD55OiMqt6lEfGxqswJK9fu0oveajtS/ +l8KikpiVpqBXnrrUOUrgNsARAS0pDTKywZwGDJ8hv4gHFZpHO4WXqZ9FOaKYtow PxO/5HNsFp6c4MZ32319kEf56IbbI9mhLEez/hFIKlqzFuTyNwA5l9BQdBPn41Q+ or83n8jWybFy5iY8bXxW/xa87uPckK1VfOh3v+4tkMP7C5S2HEOt8pprIkUWklI8 cl9gqMNwrr2lrgmCmIvDiizulimUNAIrDo1Rco/1SY9PmdwxoTVsqJrZwG1pbwzp 0XCHQIHM/Ui4zJEbIKtHGVTukCG0GGm3yuhxw2YxgUVDYNYNnS9qHjjVMPvfXnOP wUltvNT/1fHmj06PMnadt4+ZEW9IrPiIivi4tNtkCYyY/24krbC9sXBVujunr7gU uyszc8WlKb+GSm4neeF8AcCBXPTTTbBP3yG+WTaRZ6Pi46a7yxTN7oLA2/+9zjp5 Vz1m/mbRSwHE64K6ZZHpfgUVJT3hqKtb2se2VvhG6rYVmyTNXapGJUFBc/PaM9wG GzAvkoWOIkSBhoOC3UhdAuJi/WM4x8mBXIMmCREQZ80G/QaUIf9L8Tw77+6uimOK SfdjnCTMIqQ= =coqA -----END PGP SIGNATURE-----